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Data Protection toolkit 


Information Commissioner's Office 


Overview 


Following our work with over 50 town and parish councils across the UK, we’ve 
developed a suite of resources to help local councils with some of their key data 
protection issues. 


The resources cover data audits, using your own devices and data sharing. The 
materials are available for you download, print and use to improve data practices in 
your local council. 
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Data audits: 


Great Practice Parish Council 


Data Audit and Retention 


Exercise 


GDPR: A day in the life of ... 
Great Practice Parish Council 


Data audit and retention exercise 


Includes the instructions, 
glossary and resources you will 
need to complete the exercise. 


Click here to 
download. 


Using your own devices: 
Poster and factsheet 


Using your own email 


address or device for 
council business? 


59% of parish council clerks ranked the use of l 
personal email addresses and devices for council 
business as their top data protection concern. 


*poll taken at SLCC - Leadership in Action Conference June 2019 


for local councils 


The GDPR doesn’t say which email systems or devices 
should be used. But if you’re conducting council business 
involving personal data through your own email account, 
the council is responsible for the confidentiality, integrity 
and availability of that data. The same goes for using your 
own phone, laptop or tablet. 


Know who is responsible 
Consider the risks 
Be accountable 


Click on the icons below to 
download the poster and 
factsheet. 
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Pe Data sharing: 


Data sharing in local councils | 
— six steps to take Six steps for local councils 


Be clear about your purpose for sharing the information, and record 
this in your council's privacy information. 


Check the sharing is necessary for the specific purpose (required for 
most lawful bases). If you can reasonably achieve the same purpose 
another way, then the sharing won't be necessary and your lawful basis 
won't be valid. 


Determine and document your council’s lawful basis for sharing the 
information. There are six lawful bases, and the most appropriate one 
for your council will depend on your purpose. 


Share the minimum amount of personal data that is needed to help 
your council achieve its purpose. For example, you might need to share 
somebody’s current name and address, but not other information you 
hold about them. 


Provide information to individuals about why your council is collecting 
and using their personal data. Privacy information is a key 
transparency requirement under the GDPR and individuals have a right 
to know your purposes for processing their personal data, how long you 
will hold their data for, and who you'll share it with. 


Click on the icons below to 
download the poster and 
factsheet. 


Demonstrate your accountability as part of GDPR compliance. Your 
council has to take responsibility for what it does with people’s personal 
data and you need to put in place appropriate technical and 
organisational measures to meet the requirements of accountability 


Visit ico.org.uk for more guidance, advice and interactive tools 
to help your council get data protection right. 
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